Apparatus and method of detecting abnormal financial transaction

ABSTRACT

Provided are a method of detecting abnormal financial transactions and an apparatus thereof. The apparatus includes: a memory in which an abnormal transaction detection program is stored; and a processor configured to execute the program. Upon execution of the program, the processor performs a data preprocessing operation to acquired payment data, extracts at least one feature adaptively determined in advance from results of the preprocessing operation, and uses the extracted feature to determine whether the payment data correspond to an abnormal transaction through a machine learning algorithm adaptively determined in advance.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims the benefit under 35 USC 119(a) of Korean PatentApplication No. 10-2017-0073385 filed on Jun. 12, 2017 in the KoreanIntellectual Property Office, the entire disclosures of which areincorporated herein by reference for all purposes.

TECHNICAL FIELD

The present disclosure relates to a method of detecting abnormalfinancial transactions and an electronic apparatus thereof.

BACKGROUND

As channels for providing financial transaction payment services havediversified, the number of illegal use of non-face-to-face transactionshas increased. Particularly, financial institutions or electronicfinancial business operators have provided financial products andservices through a computing device, and, thus, users can use real-timefinancial transactions in an automated manner without face-to-facecontact or communication with employees of the financial institutions orelectronic financial business operators. A method for detecting andpredicting fraud in non-face-to-face transaction has become increasinglyimportant.

Most of the conventional methods for detecting abnormal financialtransactions use preset rules.

In this regard, Korean Patent No. 10-1675416 (entitled “System andmethod for real-time detection of abnormal financial transaction”)discloses a method for real-time detection of abnormal electronicfinancial transaction by minimizing a transaction delay.

In such a conventional method for detecting abnormal financialtransactions, an abnormal transaction is detected using abnormaltransaction patterns from past transaction data or statistics of pasttransaction data. Therefore, this method shows a high detection rate forthe known abnormal transaction patterns but cannot prepare for newabnormal transaction patterns.

SUMMARY

In view of the foregoing, the present disclosure provides a method ofdetecting abnormal financial transactions with guaranteed high detectionrate for new abnormal transaction patterns and an electronic apparatusthereof.

However, problems to be solved by the present disclosure are not limitedto the above-described problems. There may be other problems to besolved by the present disclosure.

According to a first aspect of the present disclosure, an apparatusincludes: a memory in which a program configured to detect abnormalfinancial transactions is stored; and a processor configured to executethe program. Upon execution of the program, the processor performs adata preprocessing operation to acquired payment data, extracts at leastone feature adaptively determined in advance from results of thepreprocessing operation, and uses the extracted feature to determinewhether the payment data correspond to an abnormal transaction through amachine learning algorithm adaptively determined in advance. Herein, theat least one feature is adaptively determined from among multiple itemsincluded in the payment data on the basis of sampling rates betweenabnormal transaction payment data and normal transaction payment dataincluded in payment data accumulated for a predetermined period of timeand particularly on the basis of a sampling rate showing the highestdetection rate among the multiple sampling rates.

According to a second aspect of the present disclosure, a method ofdetecting abnormal financial transactions includes: acquiring paymentdata and performing a data preprocessing operation to the payment data;extracting at least one feature adaptively determined in advance fromresults of the preprocessing operation; and using the extracted featureto determine whether the payment data correspond to an abnormaltransaction through a machine learning algorithm adaptively determinedin advance. Herein, the at least one feature is adaptively determinedfrom among multiple items included in the payment data on the basis ofsampling rates between abnormal transaction payment data and normaltransaction payment data included in payment data accumulated for apredetermined period of time and particularly on the basis of a samplingrate showing the highest detection rate among the multiple samplingrates.

According to a third aspect of the present disclosure, acomputer-readable storage medium stores a program configured to performthe method according to the second aspect on a computer.

According to the present disclosure, rea-time payment information isanalyzed using adaptively determined features and a machine learningalgorithm based on unsupervised learning with the features. Thus, it ispossible to detect abnormal transactions according to new abnormaltransaction patterns as well as abnormal transactions according to pastabnormal transaction patterns.

BRIEF DESCRIPTION OF THE DRAWINGS

In the detailed description that follows, embodiments are described asillustrations only since various changes and modifications will becomeapparent to those skilled in the art from the following detaileddescription. The use of the same reference numbers in different figuresindicates similar or identical items.

FIG. 1 is a block diagram of an abnormal financial transaction detectionapparatus in accordance with various embodiments described herein.

FIG. 2 is a flowchart illustrating a process of detecting an abnormaltransaction in accordance with various embodiments described herein.

FIG. 3 illustrates a result of a preprocessing operation performed topayment data in accordance with various embodiments described herein.

FIG. 4 is a flowchart illustrating a method of adaptively determining atleast one feature and a machine learning algorithm in detail inaccordance with various embodiments described herein.

FIG. 5 is an example diagram illustrating a confusion matrix based on anF-measure method in accordance with various embodiments describedherein.

FIG. 6 is a block diagram of an abnormal financial transaction detectionapparatus provided to explain a process of detecting an abnormaltransaction in accordance with various embodiments described herein.

DETAILED DESCRIPTION

Hereinafter, embodiments of the present disclosure will be described indetail with reference to the accompanying drawings so that the presentdisclosure may be readily implemented by those skilled in the art.However, it is to be noted that the present disclosure is not limited tothe embodiments but can be embodied in various other ways. In drawings,parts irrelevant to the description are omitted for the simplicity ofexplanation, and like reference numerals denote like parts through thewhole document.

Through the whole document, the term “connected to” or “coupled to” thatis used to designate a connection or coupling of one element to anotherelement includes both a case that an element is “directly connected orcoupled to” another element and a case that an element is“electronically connected or coupled to” another element via stillanother element. Further, it is to be understood that the term“comprises or includes” and/or “comprising or including” used in thedocument means that one or more other components, steps, operationand/or existence or addition of elements are not excluded in addition tothe described components, steps, operation and/or elements unlesscontext dictates otherwise.

FIG. 1 is a block diagram of an abnormal financial transaction detectionapparatus 100 in accordance with an embodiment of the presentdisclosure. Herein, the abnormal financial transaction detectionapparatus 100 is an electronic apparatus and may include variouscomputing devices (e.g., a mobile phone, a smart phone, a tablet PC, aPDA (personal digital assistance), and the like). Hereinafter, forconvenience in explanation, the abnormal financial transaction detectionapparatus 100 will be referred to as “electronic apparatus 100”.

The electronic apparatus 100 includes components for determiningpresence or absence of an abnormal transaction (or illegal transaction)by communicating with a payment system (e.g., a server provided by avalue-added network (VAN) or payment gateway (PG) operator) and afinancial system (e.g., a server managed by a credit card company orbank). Herein, an abnormal transaction may refer to “a payment made byanother person” not intended by a user of the electronic apparatus 100.

As illustrated in FIG. 1, the electronic apparatus 100 includes a memory110, a communication unit 120, and a processor 130.

The memory 110 stores various programs for controlling the electronicapparatus 100. For example, the memory 110 stores an abnormal paymentdetection program.

Herein, the memory 110 may collectively refer to a non-volatile storagedevice that retains information stored therein even when power is notsupplied and a volatile storage device that requires power to retaininformation stored therein. For example, the memory 110 collectivelyrefers to a volatile storage device and a non-volatile storage devicethat retains information stored therein even when power is not supplied.For example, the memory 110 may include NAND flash memories such as acompact flash (CF) card, a secure digital (SD) card, a memory stick, asolid-state drive (SSD), and a micro SD card, and magnetic computerstorage devices such as a hard disk drive (HDD).

The communication unit 120 includes at least one component forcommunication with the payment system and the financial system. Forexample, the communication unit 120 may include a component capable ofperforming at least one of Bluetooth, Bluetooth Low Energy (BLE),infrared Data Association (IrDA), and Zigbee communications. Otherwise,the communication unit 120 may transmit and receive a wireless signalthrough a mobile communication network or broadcasting communicationnetwork and transmit and receive a signal through a wired communicationnetwork.

The processor 130 controls overall operations of the electronicapparatus 100. To this end, the processor 130 may include at least oneof a Random Access Memory (RAM), a Read-Only Memory (ROM), a CPU, aGraphic Processing Unit (GPU), and a bus.

Further, the processor 130 executes the abnormal payment detectionprogram stored in the memory 110 to perform a process of detecting anabnormal payment.

Hereinafter, a process of detecting an abnormal transaction by theprocessor 130 will be described in detail with reference to FIG. 2.

Referring to FIG. 2, the processor 130 acquires payment data (S200).

Herein, the payment data may be information about payment which isprovided from an external server (e.g., the payment system, thefinancial system, etc.). The payment data may include multiple itemssuch as payment identification information, payment means information,payment time information, payment amount information, user information,service identification information, and the like.

Then, the processor 130 performs a preprocessing operation to theacquired payment data (S210).

Each item included in the payment data may be configured as a differentformat such as a combination of information, a pre-arranged code, or thelike and may include texts, numbers, or combinations thereof. In thiscase, the processor 130 may perform at least one of normalization,quantification, de-duplication, and correlation analysis of values ofthe respective items in the payment data as preprocessing to maximizethe efficiency of an operation.

For example, referring to FIG. 3, the processor 130 may performnormalization to payment time information (APPR_DT, APPR_TM) and paymentamount information (PRDT_PRICE) 310 and 330, and quantification totelecommunication company information (COMM_ID), service identificationinformation (SVD_ID), and user email existence information (EMAILFLA)320, 340, and 350.

Then, the processor 130 extracts an adaptively determined feature(S220).

In this case, the processor 130 may extract some items from thepreprocessed payment data as features.

The extracted features are determined from among the multiple itemsincluded in the payment data and determined on the basis of samplingrates between abnormal transaction payment data and normal transactionpayment data included in payment data accumulated for a predeterminedperiod of time (e.g., 24 hours, 72 hours, 1 week, etc.). Further, theextracted features are adaptively determined on the basis of a samplingrate showing the highest detection rate among the sampling rates betweenthe abnormal transaction payment data and the normal transaction paymentdata included in the accumulated payment data. Furthermore, in order tominimize a transaction delay caused by detection of an abnormaltransaction, these features may be determined before payment data areacquired.

Then, the processor 130 may determine whether the payment datacorrespond to an abnormal financial transaction through an adaptivelydetermined machine learning algorithm (S230).

Herein, the machine learning algorithm may be previously learned usingthe extracted features and based on unsupervised learning.

The processor 130 inputs the features extracted from the payment datainto the machine learning algorithm and then acquires a result outputaccordingly. This result may indicate a normal class (NC) or an abnormalclass (AC). Therefore, the processor 130 may check whether the paymentdata correspond to an abnormal financial transaction on the basis of theresult.

Meanwhile, the processor 130 may select one machine learning algorithmshowing the highest detection rate for the accumulated payment data fromamong multiple machine learning algorithms and thus adaptively determinea machine learning algorithm. The machine learning algorithm showing thehighest detection rate for the accumulated payment data may bedetermined before real-time payment data are acquired.

Hereinafter, a method of adaptively determining at least one feature anda machine learning algorithm by the processor 130 before payment dataare acquired will be described in detail with reference to FIG. 4.

Referring to FIG. 4, the processor 130 selects any one sampling rate Xi(i=1, 2, . . . , n) from among N number of sampling rates and samplesthe accumulated payment data with the selected sampling rate (S410).

For example, the processor 130 may set multiple sampling rates betweenabnormal transaction payment data and normal transaction payment data,such as 1:99, 5:95, 90:10, 80:20, 50:50, and the like, and may selectone of N number of sampling rates. Then, the processor 130 mayundersample or oversample the abnormal transaction payment data and thenormal transaction payment data in the accumulated payment data with theselected sampling rate.

Undersampling or oversampling is performed to solve an imbalance betweennormal transaction payment data and abnormal transaction payment dataand may reduce the number of payment data while minimizing the loss ofinformation or increase data without the distortion of results. Forexample, the undersampling may include EasyEnsenmble, BalanceCascade,OSS (one sided selection), and the like, and the oversampling mayinclude SMOTE (Synthetic Minority Oversampling Technique), BSM(borderline SMOTE), ADA SYN (Adaptive Synthetic Sampling), and the like,but may not be limited thereto.

Accordingly, an imbalance between the abnormal transaction payment dataand the normal transaction payment data can be solved. Further, thepresent method can be applied to the case where the amount ofaccumulated payment data is small or large.

Meanwhile, the processor 130 may determine the amount of sampling dataon the basis of computing performance of the electronic apparatus 100.For example, the processor 130 may evaluate performance of theelectronic apparatus 100 on the basis of predetermined referenceperformance and then undersamples all the normal transaction paymentdata and the abnormal transaction payment data with the sampling rateaccording to a result of the evaluation.

Then, the processor 130 may determine a feature candidate groupcorresponding to the sampling rate (S420).

Herein, the feature candidate group is composed of at least one featuredetermined corresponding to a specific sampling rate. Further, theprocessor 130 may determine a feature candidate group including at leastone feature by applying a ranking algorithm, a filtering algorithm, orthe like to the sampled accumulated payment data.

For example, the processor 130 may perform filtering and ranking tovalues of the respective items in the sampled accumulated payment dataaccording to a preset frequency and may classify at least onehigh-ranking item as a feature candidate group. In this case, theprocessor 130 may assign a predetermined weight and then performranking.

Then, the processor 130 selects one machine learning algorithm Yj (j=1,2, . . . , m) from among M number of machine learning algorithmcandidates (S430) and calculates a detection rate from a result of theselected machine learning algorithm (S440).

To this end, the processor 130 learns the selected machine learningalgorithm with the feature candidate group. The machine learningalgorithm is configured including a classifier that classifies inputvalues into a normal transaction or an abnormal transaction. Forexample, the machine learning algorithm may be based on an unsupervisedlearning method such as K-means, DBSCAN, Density Estimation, ExpectationMaximization, FarthestFirst, and the like. The unsupervised learningmethod enables learning of massive data and facilitates processing ofunlearned new patterns. Therefore, it is possible to prepare for newabnormal transaction patterns by learning a machine learning algorithmbased on unsupervised learning.

A result output through the machine learning algorithm may be a normalclass NC which means a normal transaction or an abnormal class (AC) thatmeans an abnormal transaction. The processor 130 may calculate adetection rate from this result on the basis of an F-measure method.

FIG. 5 is an example diagram illustrating a confusion matrix based onF-measure in accordance with an embodiment of the present disclosure.

A confusion matrix contains results of combinations between whether ornot an actual value of accumulated payment data matches with a result ofa machine learning algorithm (true or false) and whether thecorresponding value indicates an abnormal transaction or a normaltransaction (negative/positive) and shows TN (true negative), TF (truefalse), FN (false negative), and FP (false positive).

The processor 130 may calculate precision and recall using the confusionmatrix and then calculate a detection rate from them. Herein, theprecision (P value) may be calculated as {TP/(TP+FP)} and the recall (Rvalue) may be calculated as {{TP/(TP+FN)}. Further, the detection ratemay be calculated as {2X((R value)X(P value))/((R value)+(P value))}.For reference, a detection rate close to 1 indicates that abnormaltransactions have been detected well. Further, the calculated detectionrate may be stored in the memory 110.

Referring to FIG. 4 again, the processor 130 checks whether a detectionrate is calculated for each of the M number of machine learningalgorithm candidates (S450).

If a detection rate is calculated for each of the M number of machinelearning algorithm candidates, the processor 130 checks whether adetection rate is calculated for each of the N number of sampling rates(S460).

That is, the processor 130 may calculate NXM number of detection ratesfrom the M number of machine learning algorithm candidates learned usingN number of feature candidate groups.

Then, the processor 130 selects a sampling rate and a machine learningalgorithm each showing the highest detection rate (S470).

In this case, the processor 130 may select a feature candidate groupcorresponding to the sampling rate that shows the highest detectionrate.

As such, the processor 130 can adaptively determine features having thehighest abnormal transaction detection performance using a detectionrate calculated by applying various sampling rates to payment data for apredetermined period of time. Further, the processor can adaptivelydetermine a machine learning algorithm having the highest abnormaltransaction detection performance with respect to the features.

Then, the processor 130 can determine whether payment data acquired inreal time corresponds to an abnormal transaction using the adaptivelydetermined features and machine learning algorithm.

Accordingly, the electronic apparatus 100 can guarantee a high detectionrate for payment data and thus provide a use environment in which anabnormal transaction can be intercepted as soon as possible. Further,when the payment data are determined as an abnormal transaction, theelectronic apparatus 100 can provide information about the abnormaltransaction to an external server. Herein, the external server may be afinancial system or payment system which can intercept abnormaltransactions. For example, the processor 130 may transmit an abnormaltransaction notification message containing payment identificationinformation of the payment data to the external server through thecommunication unit 120. Thus, the external server may intercept thetransaction or reconfirm whether or not a user of the electronicapparatus 100 proceeds with the transaction.

FIG. 6 is a block diagram of an abnormal financial transaction detectionapparatus provided to explain a process of detecting an abnormaltransaction in accordance with another embodiment of the presentdisclosure.

Referring to FIG. 6, an electronic apparatus (i.e., abnormal financialtransaction detection apparatus) 100 a according to another embodimentof the present disclosure repeatedly provides at least one feature andmachine learning algorithm which are adaptively determined to a mobileapparatus 200 that receives real-time payment data. Therefore, it ispossible to detect whether or not the real-time payment data received bythe mobile apparatus 200 correspond to an abnormal transaction.

Specifically, if the mobile apparatus 200 acquires payment data in realtime, the mobile apparatus 200 extracts a preset feature (i.e., at leastone feature adaptively determined by the electronic apparatus 100 a)from the payment data and inputs the extracted feature into a presetmachine learning algorithm (i.e., machine learning algorithm adaptivelydetermined by the electronic apparatus 100 a). Then, the mobileapparatus 200 detects whether the payment data correspond to an abnormaltransaction on the basis of a result output through the machine learningalgorithm.

The components of the electronic apparatus 100 a illustrated in FIG. 6correspond to the respective components of the electronic apparatus 100illustrated in FIG. 1. An operation of adaptively determining at leastone feature and machine learning algorithm by the electronic apparatus100 a has been described above with reference to FIG. 4. Therefore, adetailed explanation thereof will not be given.

Meanwhile, the electronic apparatus 100 a may be included in a paymentsystem or a financial system. In this case, the electronic apparatus 100a may periodically determine at least one feature and machine learningalgorithm and provide the determined at least one feature and machinelearning algorithm to at least one mobile apparatus 200 thatcommunicates with the system.

Further, the electronic apparatus 100 a may adaptively determine atleast one feature and machine learning algorithm suitable for eachmobile apparatus using payment data for each mobile apparatus thatcommunicates with the system.

The above-described method of detecting abnormal financial transactionsaccording to an embodiment of the present disclosure can be embodied ina storage medium including instruction codes executable by a computersuch as a program module executed by the computer. A computer-readablemedium can be any usable medium which can be accessed by the computerand includes all volatile/non-volatile and removable/non-removablemedia. Further, the computer-readable medium may include all computerstorage. The computer storage medium includes all volatile/non-volatileand removable/non-removable media embodied by a certain method ortechnology for storing information such as computer-readable instructioncode, a data structure, a program module or other data.

The method and system of the present disclosure have been explained inrelation to a specific embodiment, but their components or a part or allof their operations can be embodied by using a computer system havinggeneral-purpose hardware architecture.

The above description of the present disclosure is provided for thepurpose of illustration, and it would be understood by a person withordinary skill in the art that various changes and modifications may bemade without changing technical conception and essential features of thepresent disclosure. Thus, it is clear that the above-describedembodiments are illustrative in all aspects and do not limit the presentdisclosure. For example, each component described to be of a single typecan be implemented in a distributed manner. Likewise, componentsdescribed to be distributed can be implemented in a combined manner.

The scope of the present disclosure is defined by the following claimsrather than by the detailed description of the embodiment. It shall beunderstood that all modifications and embodiments conceived from themeaning and scope of the claims and their equivalents are included inthe scope of the present disclosure.

We claim:
 1. An abnormal financial transaction detection apparatus,comprising: a memory in which a program configured to detect abnormalfinancial transactions is stored; and a processor configured to executethe program, wherein upon execution of the program, the processorperforms a data preprocessing operation to acquired payment data,extracts at least one feature adaptively determined in advance fromresults of the preprocessing operation, and uses the extracted featureto determine whether the payment data correspond to an abnormaltransaction through a machine learning algorithm adaptively determinedin advance, and the at least one feature is adaptively determined fromamong multiple items included in the payment data on the basis ofsampling rates between abnormal transaction payment data and normaltransaction payment data included in payment data accumulated for apredetermined period of time and particularly on the basis of a samplingrate showing the highest detection rate among the multiple samplingrates.
 2. The abnormal financial transaction detection apparatus ofclaim 1, wherein the processor performs at least one of normalization,quantification, de-duplication, and correlation analysis of each itemincluded in the payment data as the data preprocessing operation.
 3. Theabnormal financial transaction detection apparatus of claim 1, whereinthe machine learning algorithm is based on an unsupervised learningmethod.
 4. The abnormal financial transaction detection apparatus ofclaim 1, wherein the processor samples the accumulated payment data witheach of the multiple sampling rates and applies a filtering algorithmand a ranking algorithm to the sampled accumulated payment data todetermine multiple feature candidate groups including at least onefeature, and the processor determines a feature candidate groupcorresponding to the sampling rate showing the highest detection ratefrom among the multiple feature candidate groups.
 5. The abnormalfinancial transaction detection apparatus of claim 4, wherein theprocessor selects one machine learning algorithm showing the highestdetection rate for the accumulated payment data from among multiplemachine learning algorithms learned using the multiple feature candidategroups, respectively, as the machine learning algorithm.
 6. The abnormalfinancial transaction detection apparatus of claim 4, wherein theprocessor undersamples or oversamples the abnormal transaction paymentdata and the normal transaction payment data included in the accumulatedpayment data with the multiple sampling rates, respectively.
 7. Theabnormal financial transaction detection apparatus of claim 6, whereinthe processor determines the amount of sampling data to be undersampledor oversampled on the basis of computing performance of the abnormalfinancial transaction detection apparatus.
 8. The abnormal financialtransaction detection apparatus of claim 1, further comprising: acommunication unit configured to communicate with an external serverthat intercepts an abnormal transaction, wherein when the payment dataare determined as an abnormal transaction, the processor providesinformation about the abnormal transaction to the server through thecommunication unit.
 9. A method of detecting abnormal financialtransactions by an abnormal financial transaction detection apparatus,comprising: acquiring payment data and performing a data preprocessingoperation to the payment data; extracting at least one featureadaptively determined in advance from results of the preprocessingoperation; and using the extracted feature to determine whether thepayment data correspond to an abnormal transaction through a machinelearning algorithm adaptively determined in advance, wherein the atleast one feature is adaptively determined from among multiple itemsincluded in the payment data on the basis of sampling rates betweenabnormal transaction payment data and normal transaction payment dataincluded in payment data accumulated for a predetermined period of timeand particularly on the basis of a sampling rate showing the highestdetection rate among the multiple sampling rates.
 10. The method ofdetecting abnormal financial transactions of claim 9, furthercomprising: before the step of extracting of the at least one feature ,adaptively determining the at least one feature, wherein the step ofadaptively determining of the at least one feature includes: samplingthe accumulated payment data with each of the multiple sampling ratesand applying a filtering algorithm and a ranking algorithm to thesampled accumulated payment data to determine multiple feature candidategroups including at least one feature; and determining a featurecandidate group corresponding to the sampling rate showing the highestdetection rate from among the multiple feature candidate groups.
 11. Themethod of detecting abnormal financial transactions of claim 10, furthercomprising: before the step of determining of whether the payment datacorrespond to an abnormal transaction through the machine learningalgorithm, adaptively determining the machine learning algorithm,wherein the step of adaptively determining of the machine learningalgorithm includes: selecting one machine learning algorithm showing thehighest detection rate for the accumulated payment data from amongmultiple machine learning algorithms learned using the multiple featurecandidate groups, respectively, as the machine learning algorithm. 12.The method of detecting abnormal financial transactions of claim 10,further comprising: after the step of determining of whether the paymentdata correspond to an abnormal transaction, when the payment data aredetermined as an abnormal transaction, providing information about theabnormal transaction to an external server that intercepts an abnormaltransaction.
 13. The method of detecting abnormal financial transactionsof claim 9, wherein the machine learning algorithm is based on anunsupervised learning method.
 14. A computer-readable storage mediumthat stores a program configured to perform a method of claim 9 on acomputer.